https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T19:50:27.819879+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mlflow-2025-10279 BIT-mlflow-2025-10279 — Privilege Escalation in mlflow/mlflow 2026-10-07T19:50:27.885217+00:00

Affected: Bitnami: mlflow

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-267078 EUVD-2026-267078 2026-10-07T19:50:27.885273+00:00 EUVD-2026-267078 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10279 fkie_cve-2025-10279 2026-10-07T19:50:27.885289+00:00

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-4x5p-f36r-mxxr GHSA-4x5p-f36r-mxxr — mlflow Creates of Temporary File in Directory with Insecure Permissions 2026-10-07T19:50:27.885312+00:00

Affected: PyPI: mlflow

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

 https://cve.radiocsirt.org/vuln/pysec-2026-1639 PYSEC-2026-1639 — mlflow Creates of Temporary File in Directory with Insecure Permissions 2026-10-07T19:50:27.885332+00:00

Affected: PyPI: mlflow

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.